Klocwork is a SAST tool from Perforce Software built for safety-critical and security-sensitive development. It supports C, C++, C#, Java, JavaScript, Python, and Kotlin, with particular depth in C/C++ analysis for automotive, medical, industrial, and aerospace applications.
What is Klocwork?
Klocwork detects security vulnerabilities, coding standard violations, and reliability issues in C, C++, C#, Java, JavaScript, Python, and Kotlin. It natively supports over 50 compiler environments, which matters for embedded and safety-critical projects that use specialized toolchains.
The differential analysis engine is the key workflow feature. Instead of re-scanning an entire codebase on every commit, Klocwork analyzes only the changed files and delivers results quickly. Teams use this for continuous compliance — every commit gets checked against MISRA, AUTOSAR, CERT, or whatever standard applies.
Key features
Compliance standards
Klocwork covers both security and safety standards:
| Domain | Standards |
|---|---|
| Security | CERT C/C++, CWE, OWASP Top 10, DISA STIG, PCI DSS, ISO/IEC TS 17961 |
| Automotive | MISRA C (2004, 2012, 2023), MISRA C++, AUTOSAR C++14 |
| Aerospace | DO-178B/C (via DO-330), JSF AV C++, NASA’s 10 Rules |
| Industrial | IEC 61508, EN 50128 |
| Medical | IEC 62304 |
| Nuclear | IEC 60880 |
IDE and CI/CD integration
Klocwork provides plugins for Visual Studio, Eclipse, IntelliJ IDEA, and VS Code. Developers see findings directly in their editor as they code.
For CI/CD, Klocwork integrates with Jenkins, GitHub Actions, Azure DevOps, and GitLab CI. The custom Jenkins plugin was deprecated in favor of native integration starting from Klocwork 2024.2, giving teams more flexibility in how they connect pipelines.
Perforce Validate Platform
Klocwork integrates with the Perforce Validate Platform for centralized reporting across projects. Project Streams manage shared codebases with multiple variants — common in automotive and embedded development where a single codebase produces multiple firmware builds.
Getting started
When to use Klocwork
Klocwork is built for teams developing safety-critical or security-sensitive software in C/C++. According to MISRA’s guidelines, static analysis is a mandatory activity for safety-critical software development under ISO 26262 and IEC 61508. If you need TÜV SÜD certification evidence, MISRA compliance, or AUTOSAR checking, Klocwork is one of the few tools that provides it with formal certification.
For general-purpose SAST without safety certification requirements, tools like Coverity (also strong on C/C++), SonarQube, or Semgrep may be more cost-effective.
